Two goals of malware detection software are to have a high detection rate for actual malware, and to have a low rate of false positives. A false positive occurs when a benign file is treated as malware. Malware detection typically uses a single stage approach. With a single stage approach, the two goals are at odds with each other, as adapting the detection to increase one rate causes the other rate to also increase. By using a hybrid two stage approach, the false positive rate may be decreased while maintaining the actual detection rate.